We process contact and work-history information on behalf of staffing agencies. This page covers what we store, how it's protected, and what we'll put in writing for your security review.
Last updated: July 1, 2026
Staffing Referrals is referral-program software for staffing agencies. For personal information processed in the platform, the agency is the data controller and Staffing Referrals is the data processor. It covers ambassadors, candidates and applicants, and the agency's own recruiters and staff. Data is stored in the United States.
What the platform stores
What we do not store
Live data is retained for the duration of the customer engagement and deleted or returned on termination, per the customer agreement. Database backups expire on a rolling one-week cycle.
Everything below comes from our written policy set. If something you need isn't listed, ask us rather than assume.
TLS 1.2 or higher in transit. AES-256 at rest. Sensitive fields carry an additional application-level encryption layer managed by Staffing Referrals.
Unique individual accounts with role-based, least-privilege access. Our Access Control Policy requires MFA on administrative systems, including Google Workspace, Heroku, AWS, and Cloudflare. Access reviewed at least annually and removed promptly at separation.
The application runs on Heroku. Data lives in AWS RDS PostgreSQL (us-east-1, Multi-AZ) with automated failover. Staging and production run in separate AWS accounts. No offices, no on-premises servers.
A Cloudflare web application firewall sits in front of all application traffic, with DDoS protection and bot mitigation.
Static analysis (Brakeman) runs on every change and blocks the merge until findings are resolved. Peer code review on every change. Deployments are controlled and auditable, and production code can't be edited by hand.
Sentry, Scout, AWS CloudWatch, Cloudflare health checks, and the Google Workspace alert center route alerts to the engineering team. Intruder scans the production environment for vulnerabilities.
Daily database backups with one-week retention, plus 5-minute transaction-log point-in-time recovery. Recovery objectives: 2-hour RTO, 30-minute RPO.
A documented Incident Response Plan covers detection, containment, and recovery. If a confirmed incident involves customer data, we notify affected customers without undue delay, per our contractual obligations.
People are part of the control set. Personnel sign confidentiality agreements at hire, complete security awareness training required under our HR Security Policy, and lose access promptly when they leave.
These providers support delivery of the service and may process customer data, each under contractual confidentiality and security obligations.
| Subprocessor | What it does |
|---|---|
| Amazon Web Services | Database (RDS PostgreSQL), search (OpenSearch), and storage, hosted in the US (us-east-1). |
| Heroku | Application hosting (web and worker compute) and Redis. United States. |
| Cloudflare | Web application firewall, DDoS protection, and edge content delivery. |
| SendGrid | Transactional and system email delivery. |
| Metabase | Business intelligence and internal analytics over the production database. |
| TextUs | SMS messaging, where a customer has texting enabled. |
A new vendor that would access customer data is evaluated for its security and privacy posture before it is authorized. Operational vendors such as GitHub Enterprise, Google Workspace, Slack, Chargebee, and HubSpot support internal operations with limited or no access to customer personal data.
Staffing Referrals maintains a documented security policy set, owned by engineering leadership and reviewed at least annually. The full documents are provided to customers for security assessment under NDA.
Core policies
Supporting policies and documents
What we provide
Contact
For security questions, documentation requests, or to report a security concern:
For how this website handles visitor data, see the website privacy policy.